4 ms·
Any proper implementation of the cors eval/script constraints would block extension script injection, regardless of whether webextensions are used. You'd have t
by kevingadd 5y ago
Any proper implementation of the cors eval/script constraints would block extension script injection, regardless of whether webextensions are used. You'd have to run code outside of the page context, which automatically poses issues since the page is probably in another process.
- bfrit 5y agoThe problem is that the extension can alter or fully remove the cors headers before it injects scripts, neutering even the best configuration.